5 ms·

It seems to me the guy who reported the issue to Microsoft is doing the only thing that he can effectively do to help them. WebGL is a standard developed in an

It seems to me the guy who reported the issue to Microsoft is doing the only thing that he can effectively do to help them. WebGL is a standard developed in an open way. If someone wants to contribute, including Microsoft, they can send an e-mail to a mailing list and that will reach other people working on WebGL and hopefully a productive conversation would ensue. Microsoft choose not to do that. Instead they issued a blanket statement to the whole world that WebGL is insecure. They made no effort to improve the security of WebGL and didn't leave any opening for the discussion. They just communicated a decision. Silverlight or IE engineers are not easily reachable and cannot be engaged in an open, technical dialogue the way WebGL folks can. The only venue that Microsoft provides to give feedback and bug reports is their connect website. This is the venue that Benoit used because it was the only venue available to him, as an individual. No one, including WebGL engineers, has special powers to engage Microsoft in discussion about their products. No one needs special powers to engage WebGL folks in discussion about WebGL. So you really have your power structure backwards. Notice also how this bug report is constructive: it shows a specific problem that Microsoft can fix. Notice how Microsoft's FUD wasn't constructive: they just labeled WebGL insecure using non-specific (therefore non-fixable) arguments.

tptacek 15y ago
The only venue that Microsoft provides to give feedback and bug reports is their connect website. This is the venue that Benoit used because it was the only venue available to him, as an individual. That's not at all true, is it? http://www.microsoft.com/security/msrc/report.aspx http://www.microsoft.com/security/msrc/report.aspx
- kkowalczyk 15y ago
  Nitpicking. Either way, usually using this way to report (what Microsoft claims) is a security bug would be more stand up way to do it but in this specific case, given Microsoft's FUD designed to kill WebGL (with the consequence of Flash and Silverlight having an upper hand wrt. 3d graphics in the browser), doing it publicly was the right call. It nicely shows Microsoft's double standards which is important to the overall discussion.
  - tptacek 15y ago
    Google and Mozilla would not consider it "nitpicking" if I posted a security flaw to a public bug tracking site, then claimed "that's the only place to send them". All three of those vendors went out of their way to establish and communicate the method needed to safely publish security flaws in their products. The appearance of this report is that the reporter ignored that process out of spite. Is that the message the Web GL people are intending to send? I doubt it. Moreover, who's being punished here? Microsoft? Actions like this score PR points for Microsoft. It's users who pay the price of casual disclosure. I know that because that's what Google effectively says with their disclosure policy, and what Mozilla says with theirs. I think this was a bad call.
    - nkassis 15y ago
      I don't get it, this software (Silverlight 5) is still in development. It's not meant to be used in production. If there is a flaw it should be reported. I would too have thought Microsoft Connect was the right place to report it. I don't see why it has to be hidden. ContextIS released their Firefox image stealing bug in public and it was quickly fixed by Mozilla within a week. I think this worked pretty well as far a security release goes. And this was for software already released to the public.
      - tptacek 15y ago
        You too would have been wrong. Here's what Mozilla says about the same issue: IMPORTANT: Anyone who believes they have found a Mozilla-related security vulnerability can and should report it by sending email to the address security@mozilla.org. For more information read the rest of this document. Here's what Google says about it: If you believe you have discovered a vulnerability in a Google product or have a security incident to report, email security@google.com. Here's what Apple says about it: To report security issues that affect Apple products, please contact: product-security@apple.com Here's what Cisco says (they even provide a toll-free phone number!): Individuals or organizations that are experiencing a product security issue are strongly encouraged to contact the Cisco PSIRT. Cisco welcomes reports from independent researchers, industry organizations, other vendors, customers, and any other sources concerned with product or network security. Please contact the Cisco PSIRT directly using one of the following methods You can Google for virtually any major vendor, in the form [report XXX security vulnerability], and get instructions on how to report flaws to them. Posting flaws to public bug tracking systems is just about the worst conceivable way to do it. Public bug trackers are not always (or even usually) monitored by product security teams. As a result, for many vendors, you can find vulnerabilities in their bug trackers they don't even know about, and nobody else does either, because they were reported to a black hole. You're actually better off writing an angry blog post than putting in the public bug tracker.
- yuhong 15y ago
  MSRC is generally used to report security bugs for released products only. They do now patch some prerelease products, though.
  - tptacek 15y ago
    That's also not true.
  - marshray 15y ago
    Microsoft even started a branch for researching (and methodically disclosing) bugs in other vendors products. https://twitter.com/k8em0/status/83302574681374721 https://twitter.com/k8em0/status/83302574681374721 This makes sense when you think about it. They likely get the crash dumps from Mozilla's beta testers too. They definitely have a better handle on determining their exploitability. Nobody has more experience with video driver bugs than Microsoft.
kenjackson 15y ago
It seems to me the guy who reported the issue to Microsoft is doing the only thing that he can effectively do to help them. My complaint isn't with the bug report per se. I think filing bugs is a very valid mechanism for handling defects. WebGL is a standard developed in an open way. If someone wants to contribute, including Microsoft, they can send an e-mail to a mailing list and that will reach other people working on WebGL and hopefully a productive conversation would ensue. My point is that open standards shouldn't be blazing new trails with somewhat unknown security surfaces (etc). Open standards should take what works and say, "This is now the accepted way to do it, we have good evidence that this way works best in practice." They made no effort to improve the security of WebGL and didn't leave any opening for the discussion. They just communicated a decision. They just communicated their decision. Just as Apple said they wouldn't support Flash. In fact MS went into a fair bit more detail why they wouldn't. Honestly, I think that was a mistake. They simply should have just said they wouldn't support WebGl, and left it at that. But my broader point is that I don't like standards bodies trying to bully organizations into supporting a nascent standard that AFAICT hasn't really been vetted or sufficiently thought through yet. The C++ standards committee ran into this last time with export. They pushed in a feature no one had used in practice and hadn't really been vetted by thousands of hours of testing. The end result, a dead feature, and lots of wasted person hours. Take the time, do it right, let the vendors push forward first, and learn.
- kkowalczyk 15y ago
  A bunch of programmers involved in designing WebGL bullying Microsoft. Really? There are 2 issues that Microsoft raised: 1. Sending arbitrary GPU shaders can slow down GPUs. 2. Using standard, public, official graphics APIs provided by Windows might crash buggy drivers. Re 1: Adobe does that in Flash, Microsoft is planning to do that in Silverlight 5. WebGL isn't proposing anything that Microsoft isn't doing already. If you think WebGL is not thought out properly in that regard, neither is stuff that Microsoft is doing. Re 2: I'm really dumbfounded how Microsoft can even make this argument with a straight face. They've spent the last 15 years designing and improving DirectX but they don't really want you to use those APIs? WebGL folks can't fix the drivers, Microsoft and Intel and ATI and Nvidia can and should, regardless of WebGL. Finally, how do you propose that we vet the standard? What criteria do you propose to decide that WebGL standard is good enough? Your position (that WebGL is not good enough) cannot be disproved because you don't provide any objective criteria to decide what is "good enough". It's non-constructive hand-waving. On the other hand, WebGL is based on OpenGL, an API that has been vetted in the past 20 years, has proven to work and as far as I can tell, WebGL folks are highly competent people, both in 3D and security space.

tptacek 15y ago

The only venue that Microsoft provides to give feedback and bug reports is their connect website. This is the venue that Benoit used because it was the only venue available to him, as an individual. That's not at all true, is it? http://www.microsoft.com/security/msrc/report.aspx http://www.microsoft.com/security/msrc/report.aspx

kkowalczyk 15y ago
Nitpicking. Either way, usually using this way to report (what Microsoft claims) is a security bug would be more stand up way to do it but in this specific case, given Microsoft's FUD designed to kill WebGL (with the consequence of Flash and Silverlight having an upper hand wrt. 3d graphics in the browser), doing it publicly was the right call. It nicely shows Microsoft's double standards which is important to the overall discussion.
- tptacek 15y ago
  Google and Mozilla would not consider it "nitpicking" if I posted a security flaw to a public bug tracking site, then claimed "that's the only place to send them". All three of those vendors went out of their way to establish and communicate the method needed to safely publish security flaws in their products. The appearance of this report is that the reporter ignored that process out of spite. Is that the message the Web GL people are intending to send? I doubt it. Moreover, who's being punished here? Microsoft? Actions like this score PR points for Microsoft. It's users who pay the price of casual disclosure. I know that because that's what Google effectively says with their disclosure policy, and what Mozilla says with theirs. I think this was a bad call.
  - nkassis 15y ago
    I don't get it, this software (Silverlight 5) is still in development. It's not meant to be used in production. If there is a flaw it should be reported. I would too have thought Microsoft Connect was the right place to report it. I don't see why it has to be hidden. ContextIS released their Firefox image stealing bug in public and it was quickly fixed by Mozilla within a week. I think this worked pretty well as far a security release goes. And this was for software already released to the public.
    - tptacek 15y ago
      You too would have been wrong. Here's what Mozilla says about the same issue: IMPORTANT: Anyone who believes they have found a Mozilla-related security vulnerability can and should report it by sending email to the address security@mozilla.org. For more information read the rest of this document. Here's what Google says about it: If you believe you have discovered a vulnerability in a Google product or have a security incident to report, email security@google.com. Here's what Apple says about it: To report security issues that affect Apple products, please contact: product-security@apple.com Here's what Cisco says (they even provide a toll-free phone number!): Individuals or organizations that are experiencing a product security issue are strongly encouraged to contact the Cisco PSIRT. Cisco welcomes reports from independent researchers, industry organizations, other vendors, customers, and any other sources concerned with product or network security. Please contact the Cisco PSIRT directly using one of the following methods You can Google for virtually any major vendor, in the form [report XXX security vulnerability], and get instructions on how to report flaws to them. Posting flaws to public bug tracking systems is just about the worst conceivable way to do it. Public bug trackers are not always (or even usually) monitored by product security teams. As a result, for many vendors, you can find vulnerabilities in their bug trackers they don't even know about, and nobody else does either, because they were reported to a black hole. You're actually better off writing an angry blog post than putting in the public bug tracker.
yuhong 15y ago
MSRC is generally used to report security bugs for released products only. They do now patch some prerelease products, though.
- tptacek 15y ago
  That's also not true.
- marshray 15y ago
  Microsoft even started a branch for researching (and methodically disclosing) bugs in other vendors products. https://twitter.com/k8em0/status/83302574681374721 https://twitter.com/k8em0/status/83302574681374721 This makes sense when you think about it. They likely get the crash dumps from Mozilla's beta testers too. They definitely have a better handle on determining their exploitability. Nobody has more experience with video driver bugs than Microsoft.

kenjackson 15y ago

It seems to me the guy who reported the issue to Microsoft is doing the only thing that he can effectively do to help them. My complaint isn't with the bug report per se. I think filing bugs is a very valid mechanism for handling defects. WebGL is a standard developed in an open way. If someone wants to contribute, including Microsoft, they can send an e-mail to a mailing list and that will reach other people working on WebGL and hopefully a productive conversation would ensue. My point is that open standards shouldn't be blazing new trails with somewhat unknown security surfaces (etc). Open standards should take what works and say, "This is now the accepted way to do it, we have good evidence that this way works best in practice." They made no effort to improve the security of WebGL and didn't leave any opening for the discussion. They just communicated a decision. They just communicated their decision. Just as Apple said they wouldn't support Flash. In fact MS went into a fair bit more detail why they wouldn't. Honestly, I think that was a mistake. They simply should have just said they wouldn't support WebGl, and left it at that. But my broader point is that I don't like standards bodies trying to bully organizations into supporting a nascent standard that AFAICT hasn't really been vetted or sufficiently thought through yet. The C++ standards committee ran into this last time with export. They pushed in a feature no one had used in practice and hadn't really been vetted by thousands of hours of testing. The end result, a dead feature, and lots of wasted person hours. Take the time, do it right, let the vendors push forward first, and learn.

kkowalczyk 15y ago
A bunch of programmers involved in designing WebGL bullying Microsoft. Really? There are 2 issues that Microsoft raised: 1. Sending arbitrary GPU shaders can slow down GPUs. 2. Using standard, public, official graphics APIs provided by Windows might crash buggy drivers. Re 1: Adobe does that in Flash, Microsoft is planning to do that in Silverlight 5. WebGL isn't proposing anything that Microsoft isn't doing already. If you think WebGL is not thought out properly in that regard, neither is stuff that Microsoft is doing. Re 2: I'm really dumbfounded how Microsoft can even make this argument with a straight face. They've spent the last 15 years designing and improving DirectX but they don't really want you to use those APIs? WebGL folks can't fix the drivers, Microsoft and Intel and ATI and Nvidia can and should, regardless of WebGL. Finally, how do you propose that we vet the standard? What criteria do you propose to decide that WebGL standard is good enough? Your position (that WebGL is not good enough) cannot be disproved because you don't provide any objective criteria to decide what is "good enough". It's non-constructive hand-waving. On the other hand, WebGL is based on OpenGL, an API that has been vetted in the past 20 years, has proven to work and as far as I can tell, WebGL folks are highly competent people, both in 3D and security space.